ea5d3263fc521a0cc015fe78a8353edbb487294afd53cd55c4e7703b9216e19a

Analysis

max time kernel
150s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/08/2026, 01:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-15_26712ca05bb6f830e677b9c0db7c6384_elex_stop_vidar.exe
Size 3.1MB
Sample260815-b5rcqaxtgx
SHA256 ea5d3263fc521a0cc015fe78a8353edbb487294afd53cd55c4e7703b9216e19a
MD5 26712ca05bb6f830e677b9c0db7c6384
SHA1 8a8cdd758ee4ff8cea2abac8bd6255628bc4e8bc
SHA512 98e89bc36634212009e83625c2a5702c1bdb40502f499b4a64bc4ea3377f169dab2f88e2a88e795ec1cebf5d9296de4a189fc4371a29beb1dc32ee980790d755
SSDEEP 49152:U+ES+ES+EK+ES+ES+ES+ES+ES+EK+ES+ES+ES+ES+ES+EM8+ES+ES+EK+ES+ES+C:Zp7B
TLSH
T13EE54C09F94340B1D92B51B04DDFD3BF8A60BB2186228EFBFB4DC71B6923B916438655
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence spyware stealer

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
244	svchost_AAABAABCBACAACCCCAAACAACCCCCCCCACCCABAACACBBACBBACAAABB.exe
4376	svchost_ACCACABBABCBCBBBBCBCBCAAABBABBBACCCBBCBCCBAABCAACCABBBC.exe
2840	svchost_AAABAABCBACAACCCCAAACAACCCCCCCCACCCABAACACBBACBBACAAABB.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ABACBACBCBCCAACAABBBACCACBAAACCCAABCBACACBBBCAAABCBCBAAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACCACABBABCBCBBBBCBCBCAAABBABBBACCCBBCBCCBAABCAACCABBBC.exe"	svchost_AAABAABCBACAACCCCAAACAACCCCCCCCACCCABAACACBBACBBACAAABB.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_AABABCBABBCABCBBBACCBCAACACBABABAABCCCCBBBCBBCAABABABBAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AAABAABCBACAACCCCAAACAACCCCCCCCACCCABAACACBBACBBACAAABB.exe"	2026-08-15_26712ca05bb6f830e677b9c0db7c6384_elex_stop_vidar.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5604	sc.exe
5448	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1344	cmd.exe
4408	cmd.exe
1284	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-15_26712ca05bb6f830e677b9c0db7c6384_elex_stop_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AAABAABCBACAACCCCAAACAACCCCCCCCACCCABAACACBBACBBACAAABB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ACCACABBABCBCBBBBCBCBCAAABBABBBACCCBBCBCCBAABCAACCABBBC.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1568	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
3308	2026-08-15_26712ca05bb6f830e677b9c0db7c6384_elex_stop_vidar.exe
3308	2026-08-15_26712ca05bb6f830e677b9c0db7c6384_elex_stop_vidar.exe
3308	2026-08-15_26712ca05bb6f830e677b9c0db7c6384_elex_stop_vidar.exe
3308	2026-08-15_26712ca05bb6f830e677b9c0db7c6384_elex_stop_vidar.exe
244	svchost_AAABAABCBACAACCCCAAACAACCCCCCCCACCCABAACACBBACBBACAAABB.exe
244	svchost_AAABAABCBACAACCCCAAACAACCCCCCCCACCCABAACACBBACBBACAAABB.exe
244	svchost_AAABAABCBACAACCCCAAACAACCCCCCCCACCCABAACACBBACBBACAAABB.exe
244	svchost_AAABAABCBACAACCCCAAACAACCCCCCCCACCCABAACACBBACBBACAAABB.exe
4376	svchost_ACCACABBABCBCBBBBCBCBCAAABBABBBACCCBBCBCCBAABCAACCABBBC.exe
4376	svchost_ACCACABBABCBCBBBBCBCBCAAABBABBBACCCBBCBCCBAABCAACCABBBC.exe
2840	svchost_AAABAABCBACAACCCCAAACAACCCCCCCCACCCABAACACBBACBBACAAABB.exe
2840	svchost_AAABAABCBACAACCCCAAACAACCCCCCCCACCCABAACACBBACBBACAAABB.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	3308	2026-08-15_26712ca05bb6f830e677b9c0db7c6384_elex_stop_vidar.exe
Token: SeDebugPrivilege	244	svchost_AAABAABCBACAACCCCAAACAACCCCCCCCACCCABAACACBBACBBACAAABB.exe
Token: SeDebugPrivilege	4376	svchost_ACCACABBABCBCBBBBCBCBCAAABBABBBACCCBBCBCCBAABCAACCABBBC.exe
Token: SeDebugPrivilege	2840	svchost_AAABAABCBACAACCCCAAACAACCCCCCCCACCCABAACACBBACBBACAAABB.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3308 wrote to memory of 1344	3308	2026-08-15_26712ca05bb6f830e677b9c0db7c6384_elex_stop_vidar.exe	92
PID 1344 wrote to memory of 1568	1344	cmd.exe	94
PID 244 wrote to memory of 3260	244	svchost_AAABAABCBACAACCCCAAACAACCCCCCCCACCCABAACACBBACBBACAAABB.exe	95
PID 3308 wrote to memory of 4408	3308	2026-08-15_26712ca05bb6f830e677b9c0db7c6384_elex_stop_vidar.exe	98
PID 4408 wrote to memory of 5448	4408	cmd.exe	100
PID 3308 wrote to memory of 1284	3308	2026-08-15_26712ca05bb6f830e677b9c0db7c6384_elex_stop_vidar.exe	101
PID 1284 wrote to memory of 5604	1284	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-08-15_26712ca05bb6f830e677b9c0db7c6384_elex_stop_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-15_26712ca05bb6f830e677b9c0db7c6384_elex_stop_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3308
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCCCBAABABBBBACAAAACCBBBABAABCCBCBCBACABBAABABCCCAAAACACAAAAAAACAABABBAAACAACBBCBABCAABCACACABBACCCACCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABAABCBACAACCCCAAACAACCCCCCCCACCCABAACACBBACBBACAAABB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1344
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCCCBAABABBBBACAAAACCBBBABAABCCBCBCBACABBAABABCCCAAAACACAAAAAAACAABABBAAACAACBBCBABCAABCACACABBACCCACCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABAABCBACAACCCCAAACAACCCCCCCCACCCABAACACBBACBBACAAABB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1568
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ABACCBBBCACBBBABCBCCACBABABAACAAACBCABBCABACCACACBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABAABCBACAACCCCAAACAACCCCCCCCACCCABAACACBBACBBACAAABB.exe" start= auto displayName= "UserDataSvc_ABACCBBBCACBBBABCBCCACBABABAACAAACBCABBCABACCACACBA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4408
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ABACCBBBCACBBBABCBCCACBABABAACAAACBCABBCABACCACACBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABAABCBACAACCCCAAACAACCCCCCCCACCCABAACACBBACBBACAAABB.exe" start= auto displayName= "UserDataSvc_ABACCBBBCACBBBABCBCCACBABABAACAAACBCABBCABACCACACBA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5448
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ABACCBBBCACBBBABCBCCACBABABAACAAACBCABBCABACCACACBA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1284
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ABACCBBBCACBBBABCBCCACBABABAACAAACBCABBCABACCACACBA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5604

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABAABCBACAACCCCAAACAACCCCCCCCACCCABAACACBBACBBACAAABB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABAABCBACAACCCCAAACAACCCCCCCCACCCABAACACBBACBBACAAABB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:244
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:3260

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCACABBABCBCBBBBCBCBCAAABBABBBACCCBBCBCCBAABCAACCABBBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCACABBABCBCBBBBCBCBCAAABBABBBACCCBBCBCCBAABCAACCABBBC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4376

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABAABCBACAACCCCAAACAACCCCCCCCACCCABAACACBBACBBACAAABB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABAABCBACAACCCCAAACAACCCCCCCCACCCABAACACBBACBBACAAABB.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2840

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 c3ce97061e0840142c553befdbe8949f19902c6292cd6d416e936ddd9aa3a481
MD5 64b30f9ad7a935bc339965435cb80764
SHA1 127c6a03fcccae7b05a8459c60f519f7e802ad13
SHA512 3d44c9c6749decf404e713fc1c4b7c5151f3c61977a1a24259ce5f267d29ce05408f42d8d7b1e220f96b9a1bd2e3049b3e613d2cff9e17e8c1e409d739d68c26
MD5 SHA1 SHA512

Submit Download

windowsdesktop-runtime-8.0.15-win-x64.exe

Path C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe
Size 3.7MB
SHA256 c6efecd3ff09927c9af80ab92d1924dcb684eb90cfdf4abe6a928b99877ed37a
MD5 fad8daa4a86d37002e91952a0a64cf60
SHA1 2aa72f7a9d2b497cf147788cbaf6f4934f6a9916
SHA512 1d6677178939da79ec10dea36562b3c48113ec524a794ef023743bb0d02f658b68d67b19dbdabf655e01844efc00e0c4643608b0109185ff657a91b7bdef10a2
SSDEEP 49152:U+ES+ES+EK+ES+ES+ES+ES+ES+EK+ES+ES+ES+ES+ES+EM8+ES+ES+EK+ES+ES+R:Zp7ggZ2Hb9t+2xr
TLSH
T1FF066C05F94340B1E97B11B14CDFD37E8A24BB2587228DEBF78DCB1B6932B916439216
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\qap`g`v~dtlq
Size 10B
SHA256 1d6ecfeb0697e9ba9fe7546ff77a128015b7e5dbd9e414b19b0abaf9e4c54214
MD5 635cd937396642a044280f51361cf19e
SHA1 f384c9f14e21e2720fb21f03d0fc9883e3f06df8
SHA512 40d9077e352a4808f50114db3ca8d006624beef8582a8be5b8a2bcedc2cba72be8a8290d16970376f02d18ae8dc61eac109cac499f328715289ddf7653bffbb5
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\platforms\qap`g`v~dtlq
Size 10B
SHA256 57453b36e6eff22e49e0f4ba15ace4edaed4c1d001a84684fbbbeac8de3e39b4
MD5 ee72dd247176bc1206f314b205327d93
SHA1 a410f9858b036e71d7b5a8678339deb9d307f775
SHA512 84c304aa01c1994ace112f31c20ccaeca315d12bf3624c2ebd9d828589a13f16e8d16f318f15841351c1b887655b45d482dd76193aa26fcfbba75be250fb420f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 68825343c45eccafb2454edad8e402b2d33c1933bc6902ae84d93b9bfb334cff
MD5 6fc7d2f39254ed4bb42ac168f33567aa
SHA1 2bd876cb7607b2a2cdfc484395490ffb06b15356
SHA512 78e24571482ebc4ca83aaf3d5410946c34f5752efaba1bf1cee74793d48a62b249c477130a8a35594cc00c39cc7201224faccae5e85566233d966cad03194f83
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 85815280c87622807259ea6a92b9f0aac910464bca9354e781d38eaf7ddd1ca1
MD5 28b92dbbfe6a1d8738bc286c9f6f2ae9
SHA1 f2b43ad6ca9ea4d6ab815bed16c22c79c7ba2a2a
SHA512 d1adf72418af0fbb80e03822b924e2200c604c9b8ffd5d1fc514e4aa50b78252ec306f46da8b19378256fe02c250e5218d7a597ec15367f034fbb44d36c59da3
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 cc031d607a84d28b3d2003502b5f8ed219a8fb508f723f318602b0118adfc870
MD5 b11ce4122aa3a3915ec1764c35ef2a04
SHA1 39762933bccfad7f3703ee19227a16947727a00a
SHA512 0c179c4d672e4ff8d52fc250c3e972a9cae13fcb403e58ce45e204b27034a89d0da7e7ad61ea63e64d60b84cb25f7a956a58d97f6c33ba11683d381618655e32
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 5190e59dabc593ff753b280c7e2ff297192e168d3c3a206bd4f0fa6f34b81164
MD5 d2f5e154d11f2b7bb8c5185f3bb3164b
SHA1 e42676a37f741c0ea4d769b202d7f4a36a5c09eb
SHA512 7dab820a9f7cfa238ac587434d02ad6c6ec95ae42cd3c0ba7a4398322c42415e5019188fdff55f2566e2677536267e2af6802d748d464e73739b96caeb99d9c5
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 37d5caa181f0fddc134bfd62648904e4c8590d76bac28c15fc82432fbd154a9f
MD5 fb62a18c5974898163cb9043389db003
SHA1 96f3bd865fffdb03123517cb10e1f34cbc13aae7
SHA512 1f2d389263a568c5495ebcbf88a89790b4284492280a44846d701a111788be12f8e2d9eb0e4ad3e674bd0d7669eb7866a8fc8042d20e6599562af1cbd2f427e0
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 538c63c5078e8ffe1b24be5bab560ac31284a24b602ead4950202680af348a7a
MD5 acc24f81ae9de851241450e31a8951e7
SHA1 aacdf0ac523f49bd19155041e942134f367c30e3
SHA512 d297e88568d932363f09ce25d8fe810fe37b64b7cb6090fe9a2dbc526297be3174aeea610d5be3272e34807b1f9363243c6cd7786beaf5dc79ff95e70e0ea0ae
MD5 SHA1 SHA512

Submit Download

svchost_AAABAABCBACAACCCCAAACAACCCCCCCCACCCABAACACBBACBBACAAABB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABAABCBACAACCCCAAACAACCCCCCCCACCCABAACACBBACBBACAAABB.exe
Size 3.1MB
SHA256 ea5d3263fc521a0cc015fe78a8353edbb487294afd53cd55c4e7703b9216e19a
MD5 26712ca05bb6f830e677b9c0db7c6384
SHA1 8a8cdd758ee4ff8cea2abac8bd6255628bc4e8bc
SHA512 98e89bc36634212009e83625c2a5702c1bdb40502f499b4a64bc4ea3377f169dab2f88e2a88e795ec1cebf5d9296de4a189fc4371a29beb1dc32ee980790d755
SSDEEP 49152:U+ES+ES+EK+ES+ES+ES+ES+ES+EK+ES+ES+ES+ES+ES+EM8+ES+ES+EK+ES+ES+C:Zp7B
TLSH
T13EE54C09F94340B1D92B51B04DDFD3BF8A60BB2186228EFBFB4DC71B6923B916438655
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 df9e5256bfa2f068059aa046ce27a4a6796f87942a572948c5da5a68bcbc56a8
MD5 aeb547c7f620d8a3838cf1ecd4e1c59c
SHA1 73f11d3db6d87ef47341f4c3a753f57616619a59
SHA512 9c2f938bf43b07a0cfa5b18eafce6ad5849d34d08699fe91107eb8ec7a4aa03b9eb9ef82f16204f2e7c62ed2eebc4021eadd207496ec345ed08578aa3797a801
TLSH
T154119156E4E5DC53F83268DF9B2ACBD24CF43B8B9C5C6E54230D4119A389C31CE118E2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 906f06ffb89c0a30984839e941e2a18558f59481f9b54057591369e21a0e9328
MD5 9d3c88d23b3431c48ed0ebadaf47fa6c
SHA1 61919180d7fad50276ff1319945888f62684b3b4
SHA512 b720805ebd9d4ade0116a4a9cf801660c881884e9552b4dcc476ef819fc573c881b7ea98dfb515c5392f9329dfc818987e3d7ea3a5154c6651f6953596790d1a
TLSH
T1EE21C356D4E5CC23F8326C9F9B2ADBD24CF43B5B9C5C6E54230C42186789C32CE118A2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/244-33-0x0000000000420000-0x0000000000441000-memory.dmp

Download

memory/244-23-0x0000000000420000-0x0000000000441000-memory.dmp

Download

memory/2840-81-0x0000000000420000-0x0000000000441000-memory.dmp

Download

memory/3308-0-0x00000000006D0000-0x00000000006F1000-memory.dmp

Download

memory/3308-7-0x00000000006D0000-0x00000000006F1000-memory.dmp

Download

memory/4376-79-0x00000000003B0000-0x00000000003D1000-memory.dmp

Download